Zero hop algorithm for network threat identification and mitigation

Abstract

A method, system, apparatus, and computer-readable medium to enable a set of security device interfaces within a broadcast domain to identify and mitigate attacks. For each address of a device communicating within the broadcast domain, a responsible interface is determined by a zero hop ownership determination algorithm. The algorithm operates by counting a respective number of replies observed by each of multiple interfaces. Each reply is made in response to a respective request for one address. A responsible interface is assigned to the one address using the respective number of replies observed by each respective interface. The algorithm approximates the security device interface physically closest to the address in question without querying the switches themselves and without requiring the security device interface to be in-line on the network.

1. A computer-implemented method comprising: for each respective interface of a plurality of interfaces in a network, counting a respective number of replies observed by the respective interface, wherein each reply of the replies is made in response to a respective request of a plurality of requests, and each request of the plurality of requests is for one address; assigning a responsible interface of the plurality of interfaces to the one address using the respective number of replies observed by each respective interface; the plurality of interfaces and the one address are within a broadcast domain; managing communication with the one address in response to being assigned as the responsible interface, the managing the communication comprises redirecting communication sent by the one address in response to determining that the one address is a threat; and sending a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address. 
     
     
       2. The method of  claim 1  wherein
 the plurality of interfaces and the one address are within a segment of the network. 
 
     
     
       3. The method of  claim 1  wherein
 the network is a virtual network. 
 
     
     
       4. The method of  claim 1  wherein
 the counting is performed at a data link layer of the network. 
 
     
     
       5. The method of  claim 1  wherein
 at least one of the plurality of interfaces operates in promiscuous mode. 
 
     
     
       6. The method of  claim 1  wherein
 no interface of the plurality of interfaces is in-line on the network. 
 
     
     
       7. The method of  claim 1  wherein
 the managing the communication comprises gathering statistical information about the communication with the one address. 
 
     
     
       8. The method of  claim 1  wherein
 the managing the communication comprises
 changing a state of the one address upon determining that no communication with the one address has occurred for a period of time. 
 
 
     
     
       9. The method of  claim 1  wherein
 the managing the communication comprises
 performing mitigation during communication with the one address. 
 
 
     
     
       10. The method of  claim 9  wherein
 the performing the mitigation occurs in response to determining that the one address is a threat. 
 
     
     
       11. The method of  claim 1  wherein
 the redirecting the communication occurs in response to determining that the one address is a threat. 
 
     
     
       12. The method of  claim 1  further comprising:
 sending a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address. 
 
     
     
       13. The method of  claim 1  further comprising: in response to receiving the message from a second interface, sending a second message to the second interface, wherein the second message indicates that the second interface is the responsible interface for the one address. 
     
     
       14. The method of  claim 1  wherein
 at least one respective request of the plurality of requests is sent by each respective interface of the plurality of interfaces to the one address. 
 
     
     
       15. The method of  claim 1  wherein
 the assigning the responsible interface comprises
 determining a largest number of replies from the respective number of replies for each respective interface, and 
 identifying one respective interface having the largest number of replies as the responsible interface. 
 
 
     
     
       16. The method of  claim 1  further comprising:
 initiating the counting in response to
 receiving a packet from the one address and 
 determining that the one address is not in a list of addresses. 
 
 
     
     
       17. The method of  claim 1  further comprising:
 initiating the counting in response to expiration of a timer. 
 
     
     
       18. The method of  claim 17  wherein
 the timer expires after sufficient time has elapsed to receive a respective response for each request of the plurality of requests. 
 
     
     
       19. The method of  claim 1  further comprising:
 initiating the counting in response to a message to initiate the counting. 
 
     
     
       20. The method of  claim 19  further comprising:
 sending the message to initiate the counting to a second interface in response to determining that the second interface should be assigned as the responsible interface. 
 
     
     
       21. An apparatus comprising: computer-readable storage medium including: a counting module to count a respective number of replies observed by a respective interface of a plurality of interfaces in a network, wherein each reply of the replies is made in response to a respective request of a plurality of requests, and each request of the plurality of requests is for one address; an assigning module to assign a responsible interface of the plurality of interfaces to the one address using the respective number of replies observed by each respective interface; the plurality of interfaces and the one address are within a broadcast domain, and no interface of the plurality of interfaces is in-line on the network; at least one of the plurality of interfaces operates in promiscuous mode; a managing module to manage communication with the one address in response to being assigned as the responsible interface; and a sending module to send a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address. 
     
     
       22. The apparatus of  claim 21  wherein
 the plurality of interfaces and the one address are within a segment of the network. 
 
     
     
       23. The apparatus of  claim 21  wherein
 the network is a virtual network. 
 
     
     
       24. The apparatus of  claim 21  wherein
 the counting is performed at a data link layer of the network. 
 
     
     
       25. The apparatus of  claim 21  further comprising:
 a managing module to manage communication with the one address in response to being assigned as the responsible interface. 
 
     
     
       26. The apparatus of  claim 1  wherein managing the communication comprises gathering statistical information about the communication with the one address. 
     
     
       27. The apparatus of  claim 1  wherein managing the communication comprises changing a state of the one address upon determining that no communication with the one address has occurred for a period of time. 
     
     
       28. The apparatus of  claim 1  wherein managing the communication comprises performing mitigation during communication with the one address. 
     
     
       29. The apparatus of  claim 28  wherein
 the performing the mitigation occurs in response to determining that the one address is a threat. 
 
     
     
       30. The apparatus of  claim 1  wherein managing the communication comprises redirecting communication sent by the one address in response to determining that the one address is a threat. 
     
     
       31. The apparatus of  claim 30  wherein
 the redirecting the communication occurs in response to determining that the one address is a threat. 
 
     
     
       32. The apparatus of  claim 25  further comprising:
 a sending module to send a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address. 
 
     
     
       33. The apparatus of  claim 1  further comprising: a second sending module to send a second message to a second interface in response to receiving the message from the second interface, wherein the second message indicates that the second interface is the responsible interface for the one address. 
     
     
       34. The apparatus of  claim 1  wherein at least one respective request of the plurality of requests is sent by each respective interface of the plurality of interfaces to the one address. 
     
     
       35. The apparatus of  claim 1  wherein the assigning the responsible interface comprises determining a largest number of replies from the respective number of replies for each respective interface, and identifying one respective interface having the largest number of replies as the responsible interface. 
     
     
       36. The apparatus of  claim 1  further comprising: an initiating module to initiate the counting in response to receiving a packet from the one address and determining that the one address is not in a list of addresses. 
     
     
       37. The apparatus of  claim 1  further comprising: initiating the counting in response to expiration of a timer. 
     
     
       38. The apparatus of  claim 37  wherein
 the timer expires after sufficient time has elapsed to receive a respective response for each request of the plurality of requests. 
 
     
     
       39. The apparatus of  claim 1  further comprising: initiating the counting in response to a message to initiate the counting. 
     
     
       40. The apparatus of  claim 39  further comprising:
 sending the message to initiate the counting to a second interface in response to determining
 that the second interface should be assigned as the responsible interface. 
 
 
     
     
       41. A computer-readable storage medium comprising:
 counting instructions to count a respective number of replies observed by a respective interface of a plurality of interfaces in a network, wherein
 each reply of the replies is made in response to a respective request of a plurality of requests, and 
 each request of the plurality of requests is for one address; and 
 
 assigning instructions to assign a responsible interface of the plurality of interfaces to the one address using the respective number of replies observed by each respective interface; 
 the plurality of interfaces and the one address are within a broadcast domain; 
 managing instructions to manage communication with the one address in response to being assigned as the responsible interface; and 
 sending instructions to send a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address. 
 
     
     
       42. The computer-readable storage medium of  claim 41  further comprising:
 second sending instructions to send a second message to a second interface in response to receiving the message from the second interface, wherein
 the second message indicates that the second interface is the responsible interface for the one address. 
 
 
     
     
       43. A computer system comprising:
 counting means to count a respective number of replies observed by a respective interface of a plurality of interfaces in a network, wherein
 each reply of the replies is made in response to a respective request of a plurality of requests, and 
 each request of the plurality of requests is for one address; and 
 
 assigning means to assign a responsible interface of the plurality of interfaces to the one address using the respective number of replies observed by each respective interface; 
 the plurality of interfaces and the one address are within a broadcast domain; 
 sending means to send a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address; and 
 managing means to manage communication with the one address in response to being assigned as the responsible interface. 
 
     
     
       44. The system of  claim 43  further comprising:
 second sending means to send a second message to a second interface in response to receiving the message from the second interface, wherein
 the second message indicates that the second interface is the responsible interface for the one address.